Malicious AI Skills: 25K+ Threaten Data & Systems

Thousands of malicious AI skills have been discovered that can steal data and run malware. AI agents use these skills to interact with services and data. An analysis of nearly 900,000 AI skills found over 25,000 suspicious ones and more than 3,000 malicious skills. Between March and May 2026, the number of unique skills scanned grew from 60,000 to almost 900,000. Malicious skills increased from about 600 to over 3,000. These malicious skills have capabilities like executing commands, accessing files, and injecting code. While some of these capabilities can support legitimate tasks, they can also be used to steal data, run malware, or manipulate AI agents. Researchers also identified red-team, self-modifying, and online purchasing skills. The bottom line is that these malicious AI skills expand the attack surface for potential threats. This means users need to be aware of the new ways AI can be exploited to compromise their systems and data.